feat: implement MIP-04 encrypted media upload for Marmot groups

Adds full MIP-04 (Encrypted Media) support for Marmot group chats: Protocol layer (quartz): - Mip04MediaEncryption: ChaCha20-Poly1305 AEAD with MLS exporter key derivation (HKDF-Expand), random nonces, and AAD binding - Mip04Cipher/Mip04NostrCipher: NostrCipher adapters for the existing EncryptedBlobInterceptor download-and-decrypt pipeline - Mip04IMetaTag: NIP-92 imeta tag builder/parser with MIP-04 fields (url, m, filename, x, n, v=mip04-v2) - MlsGroupManager.mediaExporterSecret(): MLS-Exporter("marmot", "encrypted-media", 32) Upload flow (amethyst): - MarmotFileUploader: per-file Mip04NostrCipher → existing UploadOrchestrator.uploadEncrypted pipeline (compression, stripping, Blossom upload) - MarmotFileSender: builds imeta tags and sends kind:9 inner events through the MLS group message pipeline - MarmotGroupMessageComposer: adds SelectFromGallery leading icon and ChatFileUploadDialog (mirrors NIP-17 DM pattern) Display flow: - RenderMarmotEncryptedMedia: parses imeta v=mip04-v2 tags, derives Mip04Cipher, registers in EncryptionKeyCache, renders via ZoomableContentView (same path as NIP-17 encrypted files) - MarmotGroupList.noteToGroupIndex: reverse index for mapping notes back to their group ID (needed for exporter secret lookup) - ChatMessageCompose NoteRow: routes MIP-04 events to the new renderer https://claude.ai/code/session_01TckzZLpJdmE6p198DHBQ5i
2026-04-16 02:08:45 +00:00
parent 3356059d50
commit 5f5d576f1e
13 changed files with 1054 additions and 5 deletions
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.marmot.mip04EncryptedMedia
+
+import com.vitorpamplona.quartz.utils.ciphers.NostrCipher
+
+/**
+ * NostrCipher adapter for MIP-04 encrypted media decryption.
+ *
+ * This wraps the MIP-04 decryption parameters so encrypted media can be
+ * decrypted by the existing [EncryptedBlobInterceptor] OkHttp interceptor.
+ * The interceptor calls [decrypt]/[decryptOrNull] on downloaded bytes,
+ * and this cipher delegates to [Mip04MediaEncryption.decrypt].
+ *
+ * Note: [encrypt] is not used by the interceptor path but is provided
+ * for completeness.
+ */
+class Mip04Cipher(
+    val exporterSecret: ByteArray,
+    val nonce: ByteArray,
+    val originalFileHash: ByteArray,
+    val mimeType: String,
+    val filename: String,
+) : NostrCipher {
+    override fun name(): String = Mip04MediaEncryption.VERSION
+
+    override fun encrypt(bytesToEncrypt: ByteArray): ByteArray {
+        val result = Mip04MediaEncryption.encrypt(bytesToEncrypt, exporterSecret, mimeType, filename)
+        return result.ciphertext
+    }
+
+    override fun decrypt(bytesToDecrypt: ByteArray): ByteArray =
+        Mip04MediaEncryption.decrypt(
+            ciphertextWithTag = bytesToDecrypt,
+            exporterSecret = exporterSecret,
+            nonce = nonce,
+            originalFileHash = originalFileHash,
+            mimeType = mimeType,
+            filename = filename,
+        )
+
+    override fun decryptOrNull(bytesToDecrypt: ByteArray): ByteArray? =
+        try {
+            decrypt(bytesToDecrypt)
+        } catch (_: Exception) {
+            null
+        }
+}
@@ -0,0 +1,110 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.marmot.mip04EncryptedMedia
+
+import com.vitorpamplona.quartz.nip01Core.core.hexToByteArray
+import com.vitorpamplona.quartz.nip01Core.core.toHexKey
+import com.vitorpamplona.quartz.nip92IMeta.IMetaTag
+import com.vitorpamplona.quartz.nip92IMeta.IMetaTagBuilder
+
+/**
+ * MIP-04 imeta tag field names per the spec.
+ */
+object Mip04Fields {
+    const val URL = "url"
+    const val MIME_TYPE = "m"
+    const val FILENAME = "filename"
+    const val DIMENSIONS = "dim"
+    const val BLURHASH = "blurhash"
+    const val THUMBHASH = "thumbhash"
+    const val FILE_HASH = "x"
+    const val NONCE = "n"
+    const val VERSION = "v"
+}
+
+/**
+ * Parsed MIP-04 encrypted media metadata from an imeta tag.
+ */
+data class Mip04MediaMeta(
+    val url: String,
+    val mimeType: String,
+    val filename: String,
+    val originalFileHash: String,
+    val nonce: String,
+    val version: String,
+    val dimensions: String? = null,
+    val blurhash: String? = null,
+    val thumbhash: String? = null,
+) {
+    val nonceBytes: ByteArray get() = nonce.hexToByteArray()
+    val originalFileHashBytes: ByteArray get() = originalFileHash.hexToByteArray()
+
+    val isV2: Boolean get() = version == Mip04MediaEncryption.VERSION
+}
+
+/**
+ * Parse an IMetaTag into MIP-04 media metadata.
+ * Returns null if the tag is not a valid MIP-04 v2 imeta.
+ */
+fun IMetaTag.toMip04MediaMeta(): Mip04MediaMeta? {
+    val mimeType = properties[Mip04Fields.MIME_TYPE]?.firstOrNull() ?: return null
+    val filename = properties[Mip04Fields.FILENAME]?.firstOrNull() ?: return null
+    val fileHash = properties[Mip04Fields.FILE_HASH]?.firstOrNull() ?: return null
+    val nonce = properties[Mip04Fields.NONCE]?.firstOrNull() ?: return null
+    val version = properties[Mip04Fields.VERSION]?.firstOrNull() ?: return null
+
+    if (version != Mip04MediaEncryption.VERSION) return null
+    if (nonce.length != 24) return null // 12 bytes = 24 hex chars
+
+    return Mip04MediaMeta(
+        url = url,
+        mimeType = mimeType,
+        filename = filename,
+        originalFileHash = fileHash,
+        nonce = nonce,
+        version = version,
+        dimensions = properties[Mip04Fields.DIMENSIONS]?.firstOrNull(),
+        blurhash = properties[Mip04Fields.BLURHASH]?.firstOrNull(),
+        thumbhash = properties[Mip04Fields.THUMBHASH]?.firstOrNull(),
+    )
+}
+
+/**
+ * Build an MIP-04 imeta tag from encryption results and file metadata.
+ */
+fun buildMip04IMetaTag(
+    url: String,
+    mimeType: String,
+    filename: String,
+    originalFileHash: ByteArray,
+    nonce: ByteArray,
+    dimensions: String? = null,
+    blurhash: String? = null,
+): IMetaTag =
+    IMetaTagBuilder(url).apply {
+        add(Mip04Fields.MIME_TYPE, Mip04MediaEncryption.canonicalizeMimeType(mimeType))
+        add(Mip04Fields.FILENAME, filename)
+        add(Mip04Fields.FILE_HASH, originalFileHash.toHexKey())
+        add(Mip04Fields.NONCE, nonce.toHexKey())
+        add(Mip04Fields.VERSION, Mip04MediaEncryption.VERSION)
+        dimensions?.let { add(Mip04Fields.DIMENSIONS, it) }
+        blurhash?.let { add(Mip04Fields.BLURHASH, it) }
+    }.build()
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.marmot.mip04EncryptedMedia
+
+import com.vitorpamplona.quartz.marmot.mls.crypto.MlsCryptoProvider
+import com.vitorpamplona.quartz.nip44Encryption.crypto.ChaCha20Poly1305
+import com.vitorpamplona.quartz.utils.RandomInstance
+import com.vitorpamplona.quartz.utils.sha256.sha256
+
+/**
+ * MIP-04 Encrypted Media (Version 2) implementation.
+ *
+ * Encrypts/decrypts media files for Marmot groups using ChaCha20-Poly1305 AEAD
+ * with keys derived from MLS exporter secrets.
+ *
+ * Key derivation:
+ *   exporter_secret = MLS-Exporter("marmot", "encrypted-media", 32)
+ *   file_key = HKDF-Expand(exporter_secret, context, 32)
+ *   nonce = Random(12)
+ *
+ * Context layout:
+ *   "mip04-v2" || 0x00 || file_hash(32) || 0x00 || mime_type || 0x00 || filename || 0x00 || "key"
+ *
+ * AAD layout:
+ *   "mip04-v2" || 0x00 || file_hash(32) || 0x00 || mime_type || 0x00 || filename
+ */
+object Mip04MediaEncryption {
+    const val VERSION = "mip04-v2"
+    const val EXPORTER_LABEL = "marmot"
+    const val EXPORTER_CONTEXT = "encrypted-media"
+    const val EXPORTER_KEY_LENGTH = 32
+
+    private const val KEY_LENGTH = 32
+    private const val NONCE_LENGTH = 12
+    private val SCHEME_BYTES = VERSION.encodeToByteArray()
+    private val KEY_SUFFIX = "key".encodeToByteArray()
+    private val NULL_SEPARATOR = byteArrayOf(0x00)
+
+    /**
+     * Derive the MIP-04 file encryption key from the MLS exporter secret.
+     *
+     * @param exporterSecret 32-byte MLS-Exporter("marmot", "encrypted-media", 32)
+     * @param originalFileHash SHA256 hash of the original (unencrypted) file content (32 bytes)
+     * @param mimeType canonical MIME type (e.g. "image/jpeg")
+     * @param filename original filename (e.g. "photo.jpg")
+     * @return 32-byte file encryption key
+     */
+    fun deriveFileKey(
+        exporterSecret: ByteArray,
+        originalFileHash: ByteArray,
+        mimeType: String,
+        filename: String,
+    ): ByteArray {
+        require(exporterSecret.size == EXPORTER_KEY_LENGTH) {
+            "Exporter secret must be $EXPORTER_KEY_LENGTH bytes"
+        }
+        require(originalFileHash.size == 32) {
+            "File hash must be 32 bytes"
+        }
+
+        val info = buildContext(originalFileHash, mimeType, filename, KEY_SUFFIX)
+        return MlsCryptoProvider.hkdfExpand(exporterSecret, info, KEY_LENGTH)
+    }
+
+    /**
+     * Encrypt a file's bytes using MIP-04 v2.
+     *
+     * @param plaintext original file bytes
+     * @param exporterSecret 32-byte MLS exporter secret
+     * @param mimeType canonical MIME type
+     * @param filename original filename
+     * @return encryption result with ciphertext, nonce, and file hash
+     */
+    fun encrypt(
+        plaintext: ByteArray,
+        exporterSecret: ByteArray,
+        mimeType: String,
+        filename: String,
+    ): Mip04EncryptionResult {
+        val originalFileHash = sha256(plaintext)
+        val fileKey = deriveFileKey(exporterSecret, originalFileHash, mimeType, filename)
+        val nonce = RandomInstance.bytes(NONCE_LENGTH)
+        val aad = buildAad(originalFileHash, mimeType, filename)
+        val ciphertextWithTag = ChaCha20Poly1305.encrypt(plaintext, aad, nonce, fileKey)
+
+        return Mip04EncryptionResult(
+            ciphertext = ciphertextWithTag,
+            nonce = nonce,
+            originalFileHash = originalFileHash,
+        )
+    }
+
+    /**
+     * Decrypt a file's bytes using MIP-04 v2.
+     *
+     * @param ciphertextWithTag encrypted bytes (ciphertext + 16-byte Poly1305 tag)
+     * @param exporterSecret 32-byte MLS exporter secret
+     * @param nonce 12-byte nonce from the imeta tag
+     * @param originalFileHash SHA256 hash of the original file (from imeta "x" field)
+     * @param mimeType canonical MIME type (from imeta "m" field)
+     * @param filename original filename (from imeta "filename" field)
+     * @return decrypted file bytes
+     * @throws IllegalStateException if authentication fails
+     */
+    fun decrypt(
+        ciphertextWithTag: ByteArray,
+        exporterSecret: ByteArray,
+        nonce: ByteArray,
+        originalFileHash: ByteArray,
+        mimeType: String,
+        filename: String,
+    ): ByteArray {
+        require(nonce.size == NONCE_LENGTH) { "Nonce must be $NONCE_LENGTH bytes" }
+        require(originalFileHash.size == 32) { "File hash must be 32 bytes" }
+
+        val fileKey = deriveFileKey(exporterSecret, originalFileHash, mimeType, filename)
+        val aad = buildAad(originalFileHash, mimeType, filename)
+        val decrypted = ChaCha20Poly1305.decrypt(ciphertextWithTag, aad, nonce, fileKey)
+
+        // Integrity verification: SHA256(decrypted) must match originalFileHash
+        val actualHash = sha256(decrypted)
+        check(actualHash.contentEquals(originalFileHash)) {
+            "Integrity verification failed: decrypted file hash does not match original"
+        }
+
+        return decrypted
+    }
+
+    /**
+     * Build the HKDF-Expand context for key derivation:
+     * "mip04-v2" || 0x00 || file_hash(32) || 0x00 || mime_type || 0x00 || filename || 0x00 || suffix
+     */
+    private fun buildContext(
+        fileHash: ByteArray,
+        mimeType: String,
+        filename: String,
+        suffix: ByteArray,
+    ): ByteArray {
+        val mimeBytes = canonicalizeMimeType(mimeType).encodeToByteArray()
+        val filenameBytes = filename.encodeToByteArray()
+
+        val size = SCHEME_BYTES.size + 1 + fileHash.size + 1 + mimeBytes.size + 1 + filenameBytes.size + 1 + suffix.size
+        val result = ByteArray(size)
+        var offset = 0
+
+        SCHEME_BYTES.copyInto(result, offset); offset += SCHEME_BYTES.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        fileHash.copyInto(result, offset); offset += fileHash.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        mimeBytes.copyInto(result, offset); offset += mimeBytes.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        filenameBytes.copyInto(result, offset); offset += filenameBytes.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        suffix.copyInto(result, offset)
+
+        return result
+    }
+
+    /**
+     * Build the AAD (Additional Authenticated Data):
+     * "mip04-v2" || 0x00 || file_hash(32) || 0x00 || mime_type || 0x00 || filename
+     */
+    private fun buildAad(
+        fileHash: ByteArray,
+        mimeType: String,
+        filename: String,
+    ): ByteArray {
+        val mimeBytes = canonicalizeMimeType(mimeType).encodeToByteArray()
+        val filenameBytes = filename.encodeToByteArray()
+
+        val size = SCHEME_BYTES.size + 1 + fileHash.size + 1 + mimeBytes.size + 1 + filenameBytes.size
+        val result = ByteArray(size)
+        var offset = 0
+
+        SCHEME_BYTES.copyInto(result, offset); offset += SCHEME_BYTES.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        fileHash.copyInto(result, offset); offset += fileHash.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        mimeBytes.copyInto(result, offset); offset += mimeBytes.size
+        NULL_SEPARATOR.copyInto(result, offset); offset += 1
+        filenameBytes.copyInto(result, offset)
+
+        return result
+    }
+
+    /**
+     * Canonicalize a MIME type per MIP-04:
+     * - Lowercase
+     * - Trim whitespace
+     * - Strip parameters (e.g., "; charset=utf-8")
+     */
+    fun canonicalizeMimeType(mimeType: String): String =
+        mimeType.trim().lowercase().substringBefore(";").trim()
+}
+
+class Mip04EncryptionResult(
+    val ciphertext: ByteArray,
+    val nonce: ByteArray,
+    val originalFileHash: ByteArray,
+)
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.marmot.mip04EncryptedMedia
+
+import com.vitorpamplona.quartz.utils.ciphers.NostrCipher
+
+/**
+ * NostrCipher implementation for MIP-04 media encryption.
+ *
+ * Used as an adapter to integrate MIP-04 encryption into the existing
+ * [EncryptFiles] upload pipeline. After calling [encrypt], the [nonce]
+ * and [originalFileHash] fields are populated and can be read to build
+ * the imeta tag.
+ *
+ * @param exporterSecret 32-byte MLS-Exporter("marmot", "encrypted-media", 32)
+ * @param mimeType canonical MIME type for key derivation context
+ * @param filename original filename for key derivation context
+ */
+class Mip04NostrCipher(
+    val exporterSecret: ByteArray,
+    val mimeType: String,
+    val filename: String,
+) : NostrCipher {
+    var nonce: ByteArray = ByteArray(0)
+        private set
+
+    var originalFileHash: ByteArray = ByteArray(0)
+        private set
+
+    override fun name(): String = Mip04MediaEncryption.VERSION
+
+    override fun encrypt(bytesToEncrypt: ByteArray): ByteArray {
+        val result = Mip04MediaEncryption.encrypt(bytesToEncrypt, exporterSecret, mimeType, filename)
+        nonce = result.nonce
+        originalFileHash = result.originalFileHash
+        return result.ciphertext
+    }
+
+    override fun decrypt(bytesToDecrypt: ByteArray): ByteArray =
+        Mip04MediaEncryption.decrypt(
+            ciphertextWithTag = bytesToDecrypt,
+            exporterSecret = exporterSecret,
+            nonce = nonce,
+            originalFileHash = originalFileHash,
+            mimeType = mimeType,
+            filename = filename,
+        )
+
+    override fun decryptOrNull(bytesToDecrypt: ByteArray): ByteArray? =
+        try {
+            decrypt(bytesToDecrypt)
+        } catch (_: Exception) {
+            null
+        }
+}
@@ -446,6 +446,17 @@ class MlsGroupManager(
            32,
        )

+    /**
+     * Export the MIP-04 encrypted media key for a group.
+     * MLS-Exporter("marmot", "encrypted-media", 32)
+     */
+    fun mediaExporterSecret(nostrGroupId: HexKey): ByteArray =
+        requireGroup(nostrGroupId).exporterSecret(
+            "marmot",
+            "encrypted-media".encodeToByteArray(),
+            32,
+        )
+
    /**
     * Return exporter secrets from retained epochs for a group.
     *